Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/UNDERGRD/VOL_3/CUD319B.TXT

Text File | 1994-11-01 | 9.2 KB | 186 lines

------------------------------

From: Ah, sordid
Subject: From the Mailbag
Date: 3 June, 1991

********************************************************************
***  CuD #3.19: File 2 of 4: From the Mailbag                    ***
********************************************************************

From: "[e-mail] \"Robert McClenon\"
Subject: Rose and Morris Sentences
Date: 20 May 91 23:34:49 EDT

Here are my thoughts on the Len Rose sentencing.  The sentence imposed
on Rose should be compared not only to those of others caught in Sun
Devil cases, such as Riggs, Darden, and Grant, but to that of Robert
Morris Jr.  Rose, Riggs, Darden, and Grant were all given
disproportionate sentences compared to Morris.  Alternatively, Morris
was given an absurdly light sentence of community service compared to
Rose or Riggs.  Rose, Riggs, Darden, and Grant were sent to prison.
Morris was given community service.

Rose, Riggs, Darden, and Grant were prosecuted for what they are
presumed to have been trying to do.  They never did material harm.
Morris was prosecuted for what he did.   It is not established exactly
what he was trying to do, but he did substantial actual harm.

If Riggs, Darden, and Grant were in fact trying to do what it is
alleged that they were trying to do, then they were trying
unsuccessfully to do what Morris did (with or without trying): to
degrade a network to the point of unavailability.  That is the worst
explanation of what Riggs and others were trying to do in the E911
case.  That is what Morris actually did to the Internet on one
dreadful November day.

Why were Rose and Riggs dealt with more harshly than Morris?  Maybe
prosecutors don't understand what the Internet is but they understand
what a conventional telephone company is.  Conceptually the Internet
is a digital telegraph company, not very different from a telephone
company.

By the way, I don't buy the argument, expressed repeatedly in various
digests, that Rose was really only guilty of copyright violations and
not of a crime.  Look at the FBI warning on any rented videotape.
Copyright infringement is a crime, punishable by 5 years in prison.
The issue is not whether Rose committed a crime.  The issue is equity
in sentencing.  Rose committed a crime.  Riggs committed a crime.
Morris committed a crime.  The sentences were disproportionate.

Maybe Morris got off lightly compared to Riggs because no one knows
exactly what Morris's intentions were, while the Legion of Doom talked
at interminable length about theirs.  I submit that no one really
knows what the real intentions of the Legion of Doom were either.
Hackers often engage in grandiose talk.  Pranksters and vandals often
say nothing.  Neither talk at length nor the failure to discuss one's
motives is necessarily informative.  Also, no one knows what Rose's
ultimate motives were.  Presumably he was planning to capture
passwords, but that does not indicate what he planned to do with them.
Morris's real motives are unknown.  Rose's real motives are unknown.
Riggs's real motives are unknown, eclipsed by the wild hacker
rhetoric.  The difference is that Morris did real harm.

Either Morris should have gone to jail or Rose and Riggs should have
gotten community service.  I think all three should have been fined
heavily.  They were.  I think all three should have been given
community service.  Morris was.  Alternatively, all three should have
been jailed.  Two were.  Morris did real harm.  Rose didn't.  The
disparity isn't fair.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: [e-mail]
Subject: Stage.dat, Protections, and FluShotPlus
Date: Thu, 23 May 91 17:46:52 PDT

One of the problems in the recent controversy about Prodigy's
STAGE.DAT file has been that many would-be testers simply didn't have
the tools to catch Prodigy red-handed.  Instead of all the effort
spent re-installing the software on supposedly virgin diskettes and
hard disk subdirectories, we can use some readily available software
to do a more thorough job.  Although there are other pieces of code
that will work as well, I chose the virus-guard FluShotPlus as my
trapping program.  [FluShotPlus may be downloaded from the author,
Ross Greenburg's BBS at [phone].  A commercial version of the
program called Virex-PC is available in the usual locations.]
FluShotPlus works by watching key ares of your system and then
alerting you when a program does not behave according to YOUR rules.
Your rules are established in a file called FLUSHOT.DAT placed in you
root directory.  Another utility in the FSP package will allow you to
change the name and location of this file for greater security, but
let's stick to the default for purposes of this explanation.

Let's also assume that we have installed PRODIGY in C:\PRODIGY.
Assuming those conditions, here is a sample FLUSHOT.DAT file that will
protect your system and monitor file use.

 ----------------------- CUT HERE -------------------------------
R=C:\*.*
W=C:\*.*
E=C:\PRODIGY\CACHE.DAT
E=C:\PRODIGY\CONFIG.SM
E=C:\PRODIGY\DRIVER.SCR
E=C:\PRODIGY\KEYS.TRX
E=C:\PRODIGY\LOG_KEYS.TRX
E=C:\PRODIGY\MODEMS.TXT
E=C:\PRODIGY\MODEMSTR.EXE
E=C:\PRODIGY\PRODIGY.EXE
E=C:\PRODIGY\PROFILE.DAT
E=C:\PRODIGY\STAGE.DAT
E=C:\PRODIGY\TLFD0000.*
E=C:\PRODIGY\VDIPLP.TTX
 ----------------------- CUT HERE -------------------------------

The first two lines prohibit all reads and all writes of all files on
drive C:.  Add more lines to protect files on other drives.  The rest
of the file are EXCEPTION lines -- exceptions to the two rules we set
up in the first two lines.  For example, line 3 allows all access to
C:\PRODIGY\CACHE.DAT.  Any other file access in C:\PRODIGY will
provoke a bell-warning from FluShotPlus.

With this file situated in the root of C:\, all we need do is fire up
FSP.

So far, so good.  This simple setup should allow most Prodigy users to
sleep comfortably.  There is one major problem with this setup: FSP
does not handle graphics screens.  Thus, its warning screen, alerting
you to the type of access being requested, and the offending program,
remain a mystery to you.  I use a frontend to Prodigy called
Prod-Util.  It allows me to compose messages offline and upload them,
and to control the screen dumps more efficiently.  It has other
features, but those are the only two that I use.

No sooner did I have my FluShot.Dat set up than I started a Prodigy
session and got a bell-warning.  I looked all over the subdir, added
to Prod-Util files to the FLUSHOT.DAT list of permitted files and
still I got the warning.  What to do now?  I dug into my code archives
and came up with DOSWatch, a demo program that I got from Crescent
Software when I purchased their wonderful BASIC add-on library PDQ.
This little library allows me to produce the smallest BASIC code
around.  DOSWatch is similar to the other WATCH programs in the PD: it
reports on the activities of the system.  Now, usually, DOSWatch
reports directly to the screen.  But we still had the problem of
PRODIGY being a graphics-based app.  Rather than recode everything to
go into graphics mode, I decided to dump the results of DOSWatch to a
disk file.  I would not be able to stop PRODIGY from looking at my
files, but I would know after the session, which files it had looked
at.

So I skipped the installation of FluShot in order to let DOSWatch
catch Prodigy red-handed.  And sure enough, a few seconds into the
Prodigy program's load, it opened a file called KEYTRACE.AUT. Innocent
enough.  Must be a file where they keep track of where I have been in
the system during a session.  So I sent Prodigy tech support a
message, asking what KEYTRACE.AUT did.  The message came back that all
KEY files are keyboard interfaces.  But they were talking about the
.KEY files, not KEYTRACE.AUT.  So I sent another message asking them
to come clean.  Tell me what the specific file KEYTRACE.AUT did, and
while they were at it, what did the different fields in MODEMS.TXT
control?  They must have thought I was hacking the system or that
something had gone awry, for the next day, I had a call from Prodigy
tech support!  He said again that the file in question was not one of
theirs.

Stupid me!  I had completely forgotten about little PROD-UTIL, working
in the background.  Because I had not given it permission to go TSR on
me, FluShot had dutifully reported it as a violation of my rules.  [By
the way, MODEMS.TXT still remains shrouded in mystery.  Yes, it is a
comma-separated data file, but its contents and their purpose is a
trade secret.  But it only controls S-Registers and the like.  Still a
secret.]

Why narrate my tale of embarassment?  To remind all of us who run
fairly complicated setups that we need to eliminate ALL variables and
do thorough testing before we go public with accusations of
impropriety.

If you would like, I can send you a BASIC program that will create the
Watch exe file.  I have permission from Crescent to distribute my
amended version of their code.

***************************************************************************
                           >> END OF THIS FILE <<
***************************************************************************